summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorCong Wang <xiyou.wangcong@gmail.com>2020-07-08 20:13:59 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-07-22 09:31:59 +0200
commit1343c5394537d9a7c6faac028462fe4df6d8254d (patch)
treeb531ead2b3e912c49628c595a17eb671f1481599 /net
parent5c6e5496a71b9f23aff69aa588e400d38eb73eba (diff)
downloadlinux-stable-1343c5394537d9a7c6faac028462fe4df6d8254d.tar.gz
linux-stable-1343c5394537d9a7c6faac028462fe4df6d8254d.tar.bz2
linux-stable-1343c5394537d9a7c6faac028462fe4df6d8254d.zip
net_sched: fix a memory leak in atm_tc_init()
[ Upstream commit 306381aec7c2b5a658eebca008c8a1b666536cba ] When tcf_block_get() fails inside atm_tc_init(), atm_tc_put() is called to release the qdisc p->link.q. But the flow->ref prevents it to do so, as the flow->ref is still zero. Fix this by moving the p->link.ref initialization before tcf_block_get(). Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") Reported-and-tested-by: syzbot+d411cff6ab29cc2c311b@syzkaller.appspotmail.com Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r--net/sched/sch_atm.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index cd49afca9617..91bd5c839303 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -551,16 +551,16 @@ static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt,
if (!p->link.q)
p->link.q = &noop_qdisc;
pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);
+ p->link.vcc = NULL;
+ p->link.sock = NULL;
+ p->link.common.classid = sch->handle;
+ p->link.ref = 1;
err = tcf_block_get(&p->link.block, &p->link.filter_list, sch,
extack);
if (err)
return err;
- p->link.vcc = NULL;
- p->link.sock = NULL;
- p->link.common.classid = sch->handle;
- p->link.ref = 1;
tasklet_init(&p->task, sch_atm_dequeue, (unsigned long)sch);
return 0;
}